On Fri, Aug 18, 2006 at 11:09:55AM -0700, Mike McMullen wrote: > >>I've run chkrootkit on 3 systems. All report "nothing found" or "not > >>detected." What about the rpm -V for openssh-server? > >>netstat -pant only shows connections to port 22 from legit places. > >Hmmm. How many other admins does this machine have? > It's a small shop. Only me. This really tends toward the "hacked" theory. Either no one is using the connection illictly now, or it's hidden by a rootkit. But let's try to eliminate other possibilities. The "netstat -pant" (as root) should show you the process ids of the legit ssh sessions. Then, use ps (or look in proc... whatever) and see what process is the parent of that one. It should be /usr/bin/sshd. If it's *not* /usr/bin/sshd, that's peculiar. But if it *is*, and "rpm -V openssh-server" claims that the sshd is unmodifed, and yet it still claims to be the debian binary, that's even *more* peculiar. -- Matthew Miller mattdm@xxxxxxxxxx <http://mattdm.org/> Boston University Linux ------> <http://linux.bu.edu/>
